1. Access Control and Site Security
Chapter 2
Copyright 2002 Prentice-Hall

2. Figure 2-1: Access Control
Access control is the policy-driven limitation of access to systems, data, and dialogs
Prevent attackers from gaining access, stopping them if they do

3. Figure 2-1: Access Control
First Steps
Enumeration of Resources
Each important resource must be listed
Many firms did this during the Y2K crisis
Very difficult to do
Sensitivity of Each Resource
The sensitivity of each resource must be assessed

4. Figure 2-1: Access Control
Who Should Have Access?
A decision must be made over who should have access to each resource
Can be made individual by individual
More efficient to define by roles (logged-in users, system administrators, project team members, etc.)

5. Figure 2-1: Access Control
What Access Permissions (Authorizations) Should They Have?
Access permissions (authorizations) define whether a role or individual should have any access at all
and, if so, exactly what the role or individual should be allowed to do to the resource.
Usually presented as a list of permissions for users to be able to do things (read, change, execute program, etc.) for each resource
Each type of resource should have an access control policy (e.g., every router) for consistency

6. Figure 2-1: Access Control
How Should Access Control Be Implemented?
For each resource, need an access protection plan for how to implement protection in keeping with the selected control policy
For a file on a server, limit authorizations to a small group, harden the server against attack, use a firewall to thwart external attackers, etc. …

7. Figure 2-1: Access Control
Policy-Based Access Control and Protection
Have a specific access control policy and an access protection policy for each resource
Focuses attention on each resource
Guides the selection and configuration of firewalls and other protections
Guides the periodic auditing and testing of protection plans